I'm afraid I have to respond, but please don't interpet my criticism
for hostility. I feel I have to debunk some points.
On Thu, Mar 24, 2022 at 05:18:31PM +0000, SANKET RATHI via IBM Community wrote:
> Both the approaches have their pros and cons.
I assume you mean to compare distributing statically compiled
binaries, versus dynamically compiled binaries.
> If everything is built statically then you don't know what all
> dependencies are there and if there is any security vulnerabilities
> in any of the dependency. Also if there is an issue in one of the
> dependency then whole package has to be rebuilt.
That's true that static images may include older libraries. I think
that just demonstrates that dependencies should be minimized and
documented for transparency and security.
There is a major problem with dependency spam in packaging on other
platforms (ie: Linux), which is bleeding into AIX packages.
Distributing programs with dynamic dependencies that makes mandatory
use of a second parallel package manager in order to resolve those
dependencies is really only reducing the workload on the
**packager**.
It doesn't address the security concerns of those increased
dependencies, or the sudden enormous growth in trivial
dependencies. It also doesn't address the concern of creating,
securing, and maintaining parallel and conflicting package management
infrastructures.
More code == more security issues.
If I install 10x more packages in my system to get all the
dependencies, I have now 10x more software to check for
vulnerabilities and keep up to date. Now amplify that across the
install base. Our maintenance time and effort far outweighs packaging
time.
When it comes to getting software from IBM, I expect they have
encapsulated all of the dependencies and minimized my work on the
distribution side. That's why we pay for IBM software.
> The dynamic libraries and dependency is more universal solution and
> transparent. It is the method followed on other platform hence it is
> more compatible.
Google invented a whole new language (Go) which among other features
makes static binaries to deploy across their platforms to minimize
dependencies. They already faced dependency hell and made dramatic
changes to prevent it.
If Windows and Linux are your benchmarks here, they are poor
examples. AIX is more secure and reliable than these platforms
precisely because we are held to higher standards.
> Once you have setup dnf/yum then it is very easy to install any
> package from AIX toolbox or your local yum repo.
If you were on Redhat Enterprise Linux, and I told you to go setup
'apt' and download the Ubuntu repositories so I could install a
package, you'd tell me that's crazy and unsupported. It's likely that
any Redhat update would break your Ubuntu packages, and vice
versa. Why is that any different here for BFF and DNF/RPM?
Production systems are typically firewalled away from the internet for
security.
We already have existing internal infrastructure deployed to manage
AIX and software in NIM. LPP sources are distribution groups of BFF
files, and they include dependency resolution. The difference is that
it's a completely offline solution, where only code from trusted
sources (ie: IBM) is installed after being verified.
> It is similar to any rpm based Linux distro.
At the POWER VUG meeting this week the number of CVEs per OS was shown
on a slide, and from memory they had something like 8000 Linux CVE vs
80 on AIX in the time, and even fewer on PowerVM and our
hardware. Since I can't reference that slide, a few minutes searching
found an aggregation site.
For some comparison, AIX isn't even in the top 50 CVE products. All
the Linux distributions are.
https://www.cvedetails.com/top-50-products.phpRedhat has plenty (4038 total):
https://www.cvedetails.com/vendor/25/Redhat.htmlWhile AIX doesn't (286 total).
https://www.cvedetails.com/product/17/IBM-AIX.html?vendor_id=14AIX shouldn't aspire to be Linux.
-- rant over --
On a milder note Sanket, please take my criticism for what it is:
honest criticism. I'm trying to provide feedback to help ensure that
everyone can receive the best software they can, with the properly
high standards of reliability, maintainability, and security that we
should expect from AIX and IBM. I want to make sure that any technical
decisions are well thought out at all layers.
I understand you're involved in packaging free software for AIX, and
I'm sure that's a thankless job. There's a reason why software must be
packaged, and I'm grateful that IBM assigns talented resources to take
time to try and distribute common tools from other platforms to
AIX. Sometimes they are useful, sometimes they come with
liabilities. I also understand this is a "free" service, unlike paid
software from IBM. However the results impact our paid, supported,
premium platform.
I'm trying to explain that AIX is properly different from other
operating systems. It's trusted to handle some of the largest
workloads on Earth at some very critical institutions. As a result,
the standards are high.
Thanks for your efforts.
------------------------------------------------------------------
Russell Adams
Russell.Adams@AdamsSystems.nlPrincipal Consultant Adams Systems Consultancy
http://adamssystems.nl/
Original Message:
Sent: 3/24/2022 1:18:00 PM
From: SANKET RATHI
Subject: RE: Rsync installing the AIX 6100-09-04-1441
Both the approaches have their pros and cons.
If everything is built statically then you don't know what all dependencies are there and if there is any security vulnerabilities in any of the dependency.
Also if there is an issue in one of the dependency then whole package has to be rebuilt.
The dynamic libraries and dependency is more universal solution and transparent. It is the method followed on other platform hence it is more compatible.
Once you have setup dnf/yum then it is very easy to install any package from AIX toolbox or your local yum repo.
It is similar to any rpm based Linux distro.
------------------------------
SANKET RATHI
------------------------------
Original Message:
Sent: Thu March 24, 2022 12:35 PM
From: Tom McGivern
Subject: Rsync installing the AIX 6100-09-04-1441
I prefer using aixtools.net. The maintainer builds the packages into instalp format(thus shows up in lslpp output), AND, packages the dependancies as static modules. Thus saving you from the dependency hell you're starting to slide into.
www.aixtools.net/index.php/rsync
he's also been fairly active on rootvg.net to discuss his packaging.
------------------------------
Tom McGivern
Original Message:
Sent: Tue March 22, 2022 03:11 AM
From: mahesh Muvva
Subject: Rsync installing the AIX 6100-09-04-1441
rsync rpm trying to installing aix6100-09-04-1441 server but getting the error below
rpm -ivh rsync-3.2.3-1.aix6.1.ppc.rpm
error: failed dependencies:
libcrypto.a(libcrypto.so.1.0.2) is needed by rsync-3.2.3-1
liblz4.a(liblz4.so.1) is needed by rsync-3.2.3-1
lz4 >= 1.9.2 is needed by rsync-3.2.3-1
the dependency pkgs also not available in google kindly help to install the rsync in AIX 6.1
------------------------------
mahesh Muvva
------------------------------